French investment firm Auriga Partners has raised €80 million at the first closing of Cyber Ventures II, its second dedicated cybersecurity fund. The firm is targeting €100 million, with a hard cap of €120 million, after raising €55 million for its first fund.
As cyberattacks grow in scale and AI opens new vulnerabilities, the stakes are rising for Europe’s cybersecurity industry. Auriga bets that European startups have what it takes to compete with established US players, and that the continent’s growing focus on technological sovereignty will help them scale.
I caught up with managing partners Geoffroy Rosset and William Lecat about where they’re investing, how AI is changing the cybersecurity landscape, and what they believe it will take for European companies to become global leaders.
Q: This is Auriga’s second cybersecurity fund. Why did Auriga decide to specialize in cyber?
Geoffroy Rosset: Auriga decided to move towards thematic investing about 5 years ago. We’d already backed key companies such as Wallix, Nexthink and Vade through our earlier generalist funds and so already had a strong investment track record in cyber.
Those early investments have since delivered significant returns: Wallix was the first European cybersecurity company to IPO on Euronext, and the Nexthink and Vade transactions alone generated more than €500 million in distributions to our investors in 2025–2026. It takes time for these investments to mature, but these outcomes reinforced our belief in the sector!
In 2022, we launched our first dedicated cybersecurity fund, raising €55 million with the support of four prominent entrepreneurs from the industry: Jean-Noël de Galzain, founder of Wallix; Georges Lotigier, founder of Vade; Thierry Rouquet, founder of Sentryo; and Édouard de Rémur, co-founder of Oodrive and Virtual Browser. They invested in the fund themselves and helped us build a community of around 100 private investors, approximately 90% of whom come from cybersecurity or adjacent technology sectors. The first fund's investment period ended in December 2025.
Q: What changes with this second fund?
Geoffroy Rosset: The fund is bigger, with a €100 million fundraising target and a €120 million hard cap, but we're looking to back roughly the same number of startups: around 25 to 30.
To date, we've invested in four startups with the new fund: Finovox Fleuret AI, Mankinds and Nextident.
The main changes are in our investment scope and geographical reach.
First, we're broadening the stages at which we invest. The first fund focused mainly on pre-seed and seed-stage companies. With this fund, we'll invest from pre-seed through to Series A, and potentially Series B in specific cases. The European cybersecurity ecosystem has matured considerably in recent years, creating more opportunities to invest in companies at later stages.
Second, we're aiming for a more balanced European portfolio. With our first fund, roughly two-thirds of our investments were in France and one-third elsewhere in Europe. This time, we're targeting a 50/50 split between France and the rest of Europe.
We've been building a European network in cybersecurity for several years now, working alongside other investors and funds and developing relationships with cybersecurity organizations, accelerators and incubators. The team travels regularly to meet people on the ground and understand local ecosystems. Last week, for example, we were in the Netherlands, Germany and Spain. The goal is to replicate across Europe the strong network we've built in France.
Q: Where do you see the most promising opportunities in cybersecurity today, and what specific criteria will you be looking for?
William Lecat: One of the hottest topics today is cybersecurity for AI.
We initially saw it as a single emerging market, but it's become clear that it encompasses several distinct segments: protecting AI models and their intellectual property, securing the underlying infrastructure, and safeguarding AI systems throughout training, testing, and deployment.
Security needs to be built into the entire AI lifecycle, from prevention and detection to remediation. We’ve identified more than 200 companies in this space in just a few months.
Identity and access management is also gaining momentum, particularly with the rise of AI agents. As these agents become more autonomous, controlling what they can access and what they're authorized to do becomes increasingly important.
We're also looking at embedded systems, where cyber vulnerabilities can have direct physical consequences, particularly for critical infrastructure. Application security is another priority: security needs to be built into software development from the outset, rather than vulnerabilities being discovered years later in production. Finally, cryptography is an important area to watch, particularly as post-quantum technologies develop.
When it comes to our investment criteria, with early-stage investing, ultimately, it all comes down to the team. Most of the startups we meet have strong technical capabilities, but technical excellence alone isn't enough. We look at how founders work together, whether their skills complement one another, and whether the team combines technical expertise with marketing and commercial capabilities.
We're also looking for founders who can listen, adapt, and take advice. Building a global company means constantly evolving, sometimes changing direction, and developing the ability to scale beyond the initial product and market.
Q: How is AI changing the balance between attackers and defenders?
William Lecat: There’s a lot of money flowing into AI right now, but I think we’re entering a difficult period because attackers may be able to exploit these capabilities faster than defenders can deploy them.
What struck me about the Hugging Face incident, alongside the developments around Anthropic’s Mythos, is not just the capabilities themselves, but the level of autonomy we’re beginning to see. We expected AI systems to become more autonomous, but their apparent ability to organize themselves around a common objective is a significant development.
They can break down a complex goal into sub-objectives, coordinate different agents, develop a plan and adapt as they go. Some of the behavior even resembles military planning: establishing priorities, coordinating resources and, in some cases, sacrificing an individual agent’s immediate objective to achieve a broader goal.
What’s also striking is the apparent ability to cover their tracks, in a way that resembles human attackers.
These capabilities are going to be used. The question is how quickly defenders can adapt. AI offers enormous potential for cybersecurity, particularly by automating security operations, analyzing alerts and bringing the right expertise to bear. But deploying these systems effectively is complicated.
My concern is that attackers will be able to exploit these capabilities at scale before defenders have fully worked out how to use them to their advantage.
Q: Do you think Europe has what it takes to build global cybersecurity champions?
It’s a complicated question. Before looking specifically at cybersecurity, we need to consider software more broadly. Europe has produced some significant software companies, but relatively few on the scale of Microsoft or Google. The question is whether cybersecurity can become one of the industries in which Europe builds global leaders.
Cybersecurity is still a relatively young market. Ten years ago, it was much more specialized, largely serving the military and large enterprises. The situation has changed considerably, particularly around COVID, when the scale and frequency of cyberattacks became much more visible.
So I think there is still considerable potential. Europe hasn’t yet produced many companies at the scale of the largest American cybersecurity players, partly because the US started earlier. But over the past five to seven years, Europe has been accelerating and closing the gap with the US and Israel.
There are some very positive signs. European governments increasingly recognize cybersecurity as a strategic priority and are prepared to invest in it. We have the technical skills and talent, and companies are beginning to scale.
Geopolitical developments are also working in Europe’s favor, strengthening the case for greater technological sovereignty.
So yes, I think we can be optimistic. We’re moving in the right direction, and I expect more European cybersecurity champions to emerge. Whether Europe will achieve the level of sovereignty it wants remains to be seen, but the foundations are there.
